Splunk Search

Help with | rex command to extract a field?

adhwihhiahwd
Engager

hello everyone,

 

my event data looks like this

 

 

 

{\"status\":1,\"httpStatus\":200,\"event\":\"getBooks\"}

 

 

 

My goal is to extract httpStatus as a field so I can filter events by their codes(e.g 200, 400 ..)

 

I learned that we need to escape backslashes and double quotes but the command below didn't work

 

 

 

| rex "httpStatus\\\":(?<http_status>\d+)"

 

 

 

What did i do incorrectly here?

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

hi @adhwihhiahwd,

I suppose that yu tested yur regex in regex101.com and it runs but it doesn't run in Splunk,

so, try using four back slashes

| rex "httpStatus\\\\":(?<http_status>\d+)"

Ciao.

Giuseppe

View solution in original post

adhwihhiahwd
Engager

wow thanks!

4 back slashes worked...

| rex "httpStatus\\\\\":(?<http_status>\d+)"

 

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @adhwihhiahwd,

Splunk mysteries!!!

good for you, see next time!

let me know if I can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma

gcusello
SplunkTrust
SplunkTrust

hi @adhwihhiahwd,

I suppose that yu tested yur regex in regex101.com and it runs but it doesn't run in Splunk,

so, try using four back slashes

| rex "httpStatus\\\\":(?<http_status>\d+)"

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...